Any opinions?

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

I don't like the way they've handled this from a security standpoint and especially not from a disclosure standpoint.

I switched to 1password a few years ago and I like it just fine

for people who don't like their subscription pushing, bitwarden seems to work well

www.engadgethd.com - the other stuff i'm looking at

I'm trying 1Password this week, I'll try Bitwarden next week.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

Both easily imported my faults.

Both seem to have roughly the features I am looking for:
Browser Extension
iOS keyboard autofill
FaceID and/or PIN unlock on phone

Bitwarden is free, or $10 a year if you go premium.
1Password is not, but it is cheap.

I found this article which kind of explains the differences, and they are minor.

I think I'm leaning Bitwarden because I could create an account for my mother for free and try to get her to use it.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

But LastPass is not blocked.

Also none are blocked in Chrome.

Going to have to talk to the security department - but I fear they'll just say "Thanks, we'll block them all in all browsers!!"

We use a different local manager for our passwords at work.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

First, I didn't save the "secret code" for 1Password and I'm locked out and don't want to even give it another shot.

Bitwarden:
It imported my LP vault, including secure notes.

Browser extension works well.
iOS extension works and supports PIN and/or Facetime.

Wish it did these things better:
You must right click on the fields, LastPass put a control in the fields.

Browser extension timeout defaults to "On browser restart. "You can change it in settings, but LastPass had that choice available in a pulldown when you unlocked your vault - which I liked.


So I'll probably stick with BitWarden and pay the $10 a year as a tip.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

I tried Bitwarden, but there were some UI quirks that bugged me. Moved the family over to 1PW and haven't looked back.

I deleted my empty LastPass vault & account last week.

http://www.twitter.com/steelysteel

When you are in another country trying to access apps that normally work in the USA but ask for further layers of security when abroad. I don't know much about it. Sounds like a cool concept but in the back of my mind I am thinking this type of store all passwords in one place is an accident waiting to happen.

You can always salt them manually.

Like leave out the first of last few characters and then have a system where you know those last 3, or 4, or whatever.

Example of manual salt:
Say the company name for the site is Google, which has 5 characters.

Store the password like this:r9!234Y54

But the password is actually GLE-r9!234Y54-5#

Which is the last 3 letters of the company in caps and a dash prepended, then append - and the number of letters in the company name and a nonsense character.

People who don't know the system won't be able to guess it easily, especially if you use swap between techniques. Like think of a few and use them randomly.

If you forget which one you use you can always try the next one.

But you'll have the "meat" of the password easily stored.

I think the biggest vulnerability is the normal/easy two factor code sending - I think they could intercept an SMS or email easier than hacking an encrypted file.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

>People who don't know the system won't be able to guess it easily, especially if you use swap between techniques. Like think of a few and use them randomly.

There are wordlist generators that will scrape corporate websites / stuff you put on social media/ etc to generate randomized wordlists. You can then use another program to incorporate that list in its hash bruteforcing routine.

If your password/passphrase is long enough, tricks like these don't get you anything...unless you do something like storing only 4 or 5 characters in your PM and keep the remaining 10 or 20 characters in your head. But why use a password manager at that point? and if the part of the password you have in your head isn't unique, game over (changing up one or two characters don't count)

If your password is short...adding an easily (more than you would suspect) guessed/discoverable pattern to it, won't make it more secure.

If you're going to use a password manager,just make sure the master password is good, use 2fa (to help stop online attacks), and bump the key derivation iteration count as high as you can tolerate in the password manager, and let the password manager create long (which is the important thing) complex passwords for you.

~~~~~~~~
A bad Samaritan averaging above average men (c) DOOM

>If your password is short...adding an easily (more than you
>would suspect) guessed/discoverable pattern to it, won't make
>it more secure.

It won't hurt either.

But the most important thing is using random passwords that are sufficiently long - I do use the password manager to generate those.

Most sites will allow 12-14 characters for the password. Make sure you include A-Z, 0-9, and symbols (!@#$%) if allowed and multiple of each if possible. The length is more important that the characters.

Also make sure your second factor is secure. If they get control of your email address and a factor that can be used is email then you're toast.

My thinking:

^gK*9$sdvD&6Uo is a better password that MyP@ass11.
PersonWomanManCameraTVIsHeFuckingKiddingMe is a better password than ^gK*9$sdvD&6Uo. (Or maybe they are equal.)

Goo-^gK*9$sdvD&6Uo-1 is better than ^gK*9$sdvD&6Uo. (Or maybe they are equa but it can put the posters mind at ease.)

Goo-easypass-1 is worse than ^gK*9$sdvD&6Uo.

Edit: https://bitwarden.com/password-strength/

Take this with a grain of salt.

------------


Gone: My Discogs collection for The Roots:
http://www.discogs.com/user/tomhayes-roots/collection

>>If your password is short...adding an easily (more than you
>>would suspect) guessed/discoverable pattern to it, won't
>make
>>it more secure.
>
>It won't hurt either.

Yes it does. Because it leads you to believe that you're more secure than you really are. Example, Cloud-based Password Manager company sends out a note saying they were compromised, hackers got all the vaults, and they recommend changing any stored secrets. But you go, nah...I got my secret thing I do with my passwords, so I'm good.

No, that's how you get got. Like i said before, there are programs that can be scripted to handle the password routine you've described...probably a dozen py scripts on github that tackle this.

just make a longer passphrase / long complex password.

>But the most important thing is using random passwords that
>are sufficiently long - I do use the password manager to
>generate those.

This is the way.

>Most sites will allow 12-14 characters for the password. Make
>sure you include A-Z, 0-9, and symbols (!@#$%) if allowed and
>multiple of each if possible. The length is more important
>that the characters.

There's an "old infosec-wives-tale" that there's a cutoff where once you get past a certain number of characters, complexity rules don't matter (I mean if it takes 100 years vs 100000000 years...does it really matter if I force you change your password every x months). Of course, we have to re-evaluate this notion every new crop of GPUs that come out (and this reminds me that I need to revisit our policy)

>Also make sure your second factor is secure. If they get
>control of your email address and a factor that can be used is
>email then you're toast.

yubikey or authenticator app (with backup keys/device). Email gets compromised too easily(see:yahoo...yesteryear's gmail...for folks chuckling at yahoo)

>My thinking:
>
>^gK*9$sdvD&6Uo is a better password that MyP@ass11.
>PersonWomanManCameraTVIsHeFuckingKiddingMe is a better
>password than ^gK*9$sdvD&6Uo. (Or maybe they are equal.)

yup...the longer passphrase would be better (just keep in mind AI predicting what words come next in a passphrase...so don't be too predictable)

>Goo-^gK*9$sdvD&6Uo-1 is better than ^gK*9$sdvD&6Uo. (Or maybe
>they are equa but it can put the posters mind at ease.)

No no no...false sense of security. worse. it makes you not take actions that you should take when notified of a breach. Otherwise, what is this "peace of mind"? that you don't have to do anything when you hear a service you used was breached? not good.

>Goo-easypass-1 is worse than ^gK*9$sdvD&6Uo.

...and this is why these routines are bad ideas, because someone is going to try Goo-easypass-1 (just like folks used P@ssw0rd!...cuz it's complex). And when that password gets cracked, the attacker is going to go, "oh, this is what folks are doing...let me alter my script". And now Goo-^gK*9$sdvD&6Uo-1 is just as easily cracked as gK*9$sdvD&6Uo, since I know what the pattern is...you may have set back the cracking effort by weeks, maybe even months (since I have to try combinations of different schemes folks come up with)...but no where near as long if you just went with a proper long and complex password.

>Edit: https://bitwarden.com/password-strength/
>
>Take this with a grain of salt.

NIST (National Institute for Science and Technology) SP 800 series focuses on cyber/information assurance and is what federal agencies and folks that interact with federal systems / data follow (and even if you don't, are good guidelines to follow).

NIST SP 800-63 has guidance on passwords/authenticators. Providing users with the relative strength of their passwords is a recommendation of theirs, so it is great to see bitwarden has a webtool that does this.

~~~~~~~~
A bad Samaritan averaging above average men (c) DOOM

hackers will figure that out that type of 'salt'. the purpose of salting is helping with randomization. otherwise, adding your own patterns will be figured out quickly.

Y'all buy those labels, I was born supreme

>When you are in another country trying to access apps that normally work in the USA but ask for further layers of security when abroad.

You can enforce different security controls based on conditions (e.g.; someone logs in from a location where they normally don't...boom captcha and/or force a 2fa challenge)

>Sounds like a cool concept but in the back of my mind I am thinking this type of store all passwords in one place is an accident waiting to happen.

There are risks involved, for sure (but nothing is zero risk...unless you just don't do things on the internet).

Outside of LastPass' fumbling of the incident, these password management platforms really are designed to slowdown someone abusing the secrets being stored (hinges, usually, on master password strength and pbkd iteration count). There are captchas and 2fa to slow down unauthorized folks from breaking down the front door. Then there's the key derivation function itself (slows down bruteforcing of passwords)...you'll see an iteration count in settings somewhere in the password manger...the larger, the better...of course, the larger it is slows you down too (but you aren't trying to guess your password...so it has a much more drastic effect on brutefore attempts)

When it comes to the master passwords, just follow best practices (this isn't from me, this is from the people I follow to do my job...NIST): "Choose a long passphrase for the master password to the password manager and protect it from being stolen. A passphrase can be made sufficiently long to protect against attacks while still allowing memorization." (https://pages.nist.gov/800-63-FAQ/#q-b10)

When it comes to creating / storing passwords, just let the password manager do its thing...you aren't buying yourself anything by adding numbers and other easily guessable patterns to the password to an already long password generated by the password generator.

~~~~~~~~
A bad Samaritan averaging above average men (c) DOOM

pretty good so far.

Y'all buy those labels, I was born supreme